The protection of personnel, hardware, programs, networks, and data from physical circumstances and events.

learn more… | top users | synonyms (1)

156
votes
12answers
35k views

How is an ATM secure?

I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since ...
101
votes
12answers
22k views

What's to stop someone from 3D print cloning a key?

My friend just posted a picture of her key to instagram and it occurred to me that with such a high res photo, the dimensions of the key could easily be worked out. Therefore the key could be ...
89
votes
13answers
9k views

Why do we lock our computers?

It's common knowledge that if somebody has physical access to your machine they can do whatever they want with it1. So why do we always lock our computers? If somebody has physical access to my ...
71
votes
6answers
10k views

Can a lock picker slowly undermine the security of a deadbolt door?

I have a space for computers secured with a simple deadbolt. Someone keeps coming to pick the lock. While working there, I have scared them away three times. There are cameras, but not in useful ...
69
votes
5answers
5k views

Somebody bumped into me, next day my storage unit was burglarized

While I was walking in the street, somebody carrying a laptop bag bumped into me, and the next day I found out that my storage unit was burglarized and some important items were stolen. My storage ...
40
votes
11answers
7k views

Is it possible to turn a computer into a bomb?

I know this newspaper article sounds absurd. Even if a machine is compromised we (should) have hardware safe guards in all our devices to prevent the software from damaging the hardware. But is it ...
38
votes
9answers
20k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
32
votes
3answers
1k views

How can you judge the physical security of a padlock?

I recently learnt to pick locks. Eager to test out my skills, I tried picking a padlock I'd been using on a secure storage box for a number of years, and found that it only had one pin - I can get ...
31
votes
5answers
2k views

Are there any guidelines for passwords that need to be read out loud?

I recently saw the movie Olympus Has Fallen. Like in many action movies, at the end a missile is launched, and the hero (Mike Banning, played by Gerard Butler) has 60 seconds to recall the launch in ...
28
votes
7answers
5k views

Methods for protecting computer systems from physical attacks

I am interested in cost effective and creative ideas for detecting physical attacks against computer systems. This includes, but is not limited to Tamper Evident security measures. Consider the ...
27
votes
2answers
16k views

Is there any way to tell if CCTV is on or not?

Is there any way that an attacker can identify if a CCTV camera is on/operational without direct physical access to the cable/camera? If it is on, is there any way an attacker can tell if its being ...
26
votes
2answers
2k views

Can a connected USB device read all data from the USB bus?

Is it possible for a (malicious) (hardware) USB device to access all the data that is transferred through the USB bus and then read/store this information, essentially sniffing all transferred data? ...
25
votes
7answers
2k views

Protecting critical state infrastructure from the aftermath of a nuclear blast

Countries rely on computer infrastructure for a huge percentage of communications and military management, as well as utilities like electricity. Unfortunately, nuclear attacks release massive ...
23
votes
2answers
3k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
23
votes
1answer
8k views

High-frequency noise deterrents

I've found that walking past certain boutique stores in my city that some places have installed very loud high-frequency noise generators. These cause a fair amount of discomfort for passers by that ...
22
votes
6answers
2k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
21
votes
5answers
3k views

What is the most security benefit of a clean desk policy?

Starting to study for Security+ using Darril Gibson's book I took the pre-exam and one of the latest questions is “What is the most security benefit of a clean desk policy?” The choices are: ...
21
votes
2answers
31k views

Disabling/Destroying CCTV/IP Cameras with Lasers?

@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
21
votes
7answers
1k views

Securing the security guy's home office: what should we do?

I read an article in the latest InfoSecurity magazine (an infosec trade rag by Elsevier) saying that us security professionals aren't necessarily taking the correct steps to protect our own home ...
19
votes
9answers
1k views

What's a good way to trigger a hidden 'distress signal' in instant messaging?

Here's the scenario: Alice and bob use Off-the-record messaging to communicate over IM. The have: Encryption Authentication Deniability Perfect forward secrecy They communicate after ...
19
votes
2answers
4k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
19
votes
4answers
1k views

Securing an area both physically and technically

I work for a commercial printing company, and we're beginning to get a couple jobs labeled "High Security". Essentially this means that if any pictures/information/files/etc. of the product were ...
16
votes
3answers
779 views

Risks of Mullions in High Security Areas

I have a storage space full of information assets. The room itself is sound; there are no windows, the walls go all the ceiling, and there is only a single entrance with two good stout doors and high ...
15
votes
4answers
1k views

How do you prevent physical backups from being stolen?

I'm sure, by now, we're all aware of the need to encrypt backup disks, but what can be done on the physical security side of things to prevent backups from being stolen or damaged? Particularly: ...
14
votes
2answers
13k views

What is the difference between types of motion sensors?

So i understand there are a number of different motion sensor technologies out where including Active Infrared (AIRs), Passive Infrared (PIRs), Microwave motion sensors and Ultrasonic motion sensors. ...
13
votes
5answers
2k views

How to protect source code locally when traveling with it [duplicate]

I will be traveling abroad for several weeks on a business trip as a consultant. I will carry a laptop with an IDE and all the necessary source code so I can make changes on site (which is the ...
13
votes
3answers
36k views

Can law enforcement track a criminal through dynamic IP address?

I ask because a week ago my home was broken into and, among other things, my iMac computer was stolen. I am desperate to get it back because it has all the pictures of my daughters from the last ...
12
votes
6answers
4k views

Does the US government protect its physical internet lines in the US?

It seems like there are lots of ways to prevent man in the middle attacks. I've read many on here and on the rest of the internet. According to wiki you need a secure channel as well to completely ...
12
votes
2answers
315 views

Establishing routines on what to do if a PC gets stolen

I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal. ...
12
votes
3answers
1k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
12
votes
1answer
594 views

Slot machine segfault: what can we determine?

We walked into a casino and saw this near the entrance. I don't have a specific question, but is there anything that would be interesting to share and explain from the image?
11
votes
3answers
4k views

How can I prevent someone from accessing a Windows XP system via boot disk?

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: ...
10
votes
3answers
5k views

Using RFID-only on door lock to house?

I'm thinking of equipping the door to my house with an RFID-reader and a custom arduino-like board to do the authentication. My question is what is the recommended security level for a normal house ...
10
votes
5answers
415 views

Resources for physical security questions

What are good resources for the physical security questions that IT organizations face? Like best practices for locks and seals on servers and kiosks, personnel access mechanisms and policies, ...
10
votes
2answers
3k views

“Friend” stole SD card. Tracing an SD card?

First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
10
votes
4answers
32k views

Can an employer access Whatsapp messages if you are using their servers?

Does anyone know if an employer can access whatsapp messages if you are using their servers? Whatsapp apparently say the messages are encrypted, but I'm not sure about this.
10
votes
3answers
498 views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
9
votes
1answer
464 views

How to apply IT Security knowledge to Home Security?

Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
9
votes
3answers
959 views

Storing Credit Cards

Okay, so storing digitized credit card information/records is a well documented process when it comes to best practices. I recently got asked how a company can store, retrieve and process physical ...
9
votes
2answers
755 views

How do I report a vulnerability to a large organization that doesn't believe it has a problem?

This issue is more political than technical. The organization has a lot of computers that connect via web browser to a central database. Customers are regularly left unattended with physical access ...
9
votes
1answer
231 views

Physical security - responsible disclosure

I recently discovered a way to bypass a commonly used security seal system, requiring no special equipment and taking only a matter of seconds. I feel obliged to disclose this, so as to avoid the ...
9
votes
3answers
1k views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...
9
votes
2answers
916 views

How does one evaluate tamper-resistant envelopes/packaging?

In contrast to digital cryptographic algorithms and protocols where many qualified high-IQ individuals dig into the details and specifics, physical tamper resistance for low-tech packages is not ...
8
votes
6answers
6k views

Is it safe to use virtual machines when examining malware?

We want to study for the CEH program and have downloaded 12 DVDs that 6 DVDs are software key-loggers, Trojans, etc. that are all detected by antivirus. This prevents us from examining them and ...
8
votes
4answers
361 views

How to test a physical machine?

In two weeks time, I will have to test a couple of computers that a client would like to provide to its employees. The main concern is making sure that the employees won't be able to use those ...
8
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
8
votes
4answers
461 views

Best practices for physically securing a notebook

If the user knows that other people will repeatedly have physical access to her notebook - running Linux - while she is absent, and that there is no way around this, what are best practices for ...
8
votes
3answers
421 views

Securing a LAN without Physical Security

I've got an interesting dilemma. I have a large (50+ users) office that is going to be on the campus of a local university. The purpose is to foster collaboration, etc, but the open environment is ...
7
votes
2answers
296 views

Building's server room is unlocked: What danger is my building in?

In one of the buildings I work in, there are lawyers and accountants, web developers and marketers, and numerous other small businesses. Everyone's (shared) internet is routed through the same server ...
7
votes
1answer
1k views

What is the difference between Simple Power Analysis and Differential Power Analysis?

What is the difference between Simple Power Analysis (SPA) and Differential Power Analysis (DPA) and why is it not possible to do an SPA attack on FPGAs? My basic understanding is they are ...